feat(linux): Initial Linux support - #739

Merged

rabbitstack merged 65 commits into

Sep 28, 2026

Commits on Sep 28, 2026

chore(deps): Add cilium/ebpf dependency

mostafa
authored and
rabbitstack
committed
f29acf6
chore(ebpf): Add feature probes and race-safe process reconciler

mostafa
authored and
rabbitstack
committed
c0f504a
chore(ebpf): Add CO-RE spike for exec and task iterator

mostafa
authored and
rabbitstack
committed
c24ea9d
docs(ebpf): Document Linux eBPF feasibility and build gating worklist

mostafa
authored and
rabbitstack
committed
5785ab0
fix(ebpf): Harden spike reconciler ownership and shutdown paths

mostafa
authored and
rabbitstack
committed
e054729
fix(ebpf): Restore cilium/ebpf module and rename import alias

mostafa
authored and
rabbitstack
committed
9b80f89
refactor(bootstrap): Split bootstrap and CLI entrypoints for Linux

mostafa
authored and
rabbitstack
committed
d8592b3
feat(event): Add Linux semantic event type identifiers

mostafa
authored and
rabbitstack
committed
ef171b1
feat(config): Add Linux event source configuration

mostafa
authored and
rabbitstack
committed
13f58b7
refactor(ps): Introduce Resolver and Linux snapshotter

mostafa
authored and
rabbitstack
committed
40f1d5f
fix(build): Gate remaining Windows-only packages for Linux builds

mostafa
authored and
rabbitstack
committed
cebca20
fix(build): Gate Windows-only packages for Linux compilation

mostafa
authored and
rabbitstack
committed
a3fdfce
fix(build): Remove superseded Windows-gated catalog copies

mostafa
authored and
rabbitstack
committed
e119ecb
feat(event): Add Linux event helpers and parameter formatting

mostafa
authored and
rabbitstack
committed
9f6ca59
feat(ps): Implement LinuxSnapshotter and ProcessKey

mostafa
authored and
rabbitstack
committed
b8dcc6b
refactor(rules): Migrate shared consumers to ps.Resolver

mostafa
authored and
rabbitstack
committed
a6acbf7
chore(build): Attribute new Linux files to Mostafa Moradian

mostafa
authored and
rabbitstack
committed
0057502
chore(ebpf): Attribute eBPF spike files to Mostafa Moradian

mostafa
authored and
rabbitstack
committed
3c13e4f
refactor(cli): Share config/list/rules/stats commands across platforms

mostafa
authored and
rabbitstack
committed
e893121
fix(cap): Drop Handle and PE capture sections on Linux

mostafa
authored and
rabbitstack
committed
67c2666
refactor(ps): Prefer per-platform Snapshotter interfaces

mostafa
authored and
rabbitstack
committed
5fbf265
refactor(config): Split alertsender loading by platform

mostafa
authored and
rabbitstack
committed
a3afc8d
refactor(config): share platform-neutral configuration

mostafa
authored and
rabbitstack
committed
4e9edda
refactor(event): define Linux-native event semantics

mostafa
authored and
rabbitstack
committed
32cb9e8
refactor(rules): adapt filtering to platform event models

mostafa
authored and
rabbitstack
committed
88a2cfd
refactor(ps): remove Windows concepts from Linux process state

mostafa
authored and
rabbitstack
committed
2416794
refactor(platform): align local transports and file layout

mostafa
authored and
rabbitstack
committed
52b9d4b
refactor(config): enforce Linux-native event settings

mostafa
authored and
rabbitstack
committed
50bad3e
feat(ebpf): Add Linux process event source

mostafa
authored and
rabbitstack
committed
dafcc98
fix(ebpf): Skip optional fork and vfork attach failures

mostafa
authored and
rabbitstack
committed
546fd09
fix(ebpf): Emit process exits from sched_process_exit

mostafa
authored and
rabbitstack
committed
df8c389
fix(ebpf): Preserve ring buffer order during startup replay

mostafa
authored and
rabbitstack
committed
d845c7c
test(event): Cover the Linux sequencer

mostafa
authored and
rabbitstack
committed
c52ed31
refactor(bootstrap): Align Linux bootstrap with platform conventions

mostafa
authored and
rabbitstack
committed
b80b1fa
ci: Validate PR titles targeting linux-port

mostafa
authored and
rabbitstack
committed
90ec3db
refactor(ebpf): Simplify the ring buffer record model

mostafa
authored and
rabbitstack
committed
d3daa2c
feat(event): Add Linux syscall telemetry types and parameters

mostafa
authored and
rabbitstack
committed
f04626d
feat(ebpf): Extend the shared syscall record and enabled-type map

mostafa
authored and
rabbitstack
committed
e402a4d
feat(ebpf): Capture file, network, memory, and process-control syscalls

mostafa
authored and
rabbitstack
committed
151dca5
test(ebpf): Cover the MVP syscall event matrix

mostafa
authored and
rabbitstack
committed
e79d9d6
refactor(ebpf): Capture process-control syscalls at exit

mostafa
authored and
rabbitstack
committed
8f38145
feat(filter): Add Linux field catalog for the syscall event matrix

mostafa
authored and
rabbitstack
committed
54978c0
feat(filter): Evaluate Linux process, file, network, memory, and thread fields

mostafa
authored and
rabbitstack
committed
c687d0f
test(filter): Cover Linux field compile, evaluation, defaults, and truncation

mostafa
authored and
rabbitstack
committed
da70c08
refactor(filter): Align Linux field names with catalog conventions

mostafa
authored and
rabbitstack
committed
08d0f2e
feat(build): Add Makefile for build targets
rabbitstack
committed
d42955a
fix(build): Point Makefile bpf targets at the generated package

mostafa
authored and
rabbitstack
committed
ef68c7e
feat(rules): Signal kill after confirming process instance identity

mostafa
authored and
rabbitstack
committed
78bb439
feat(rules): Add Linux macros and rules for execve, ptrace, kill, and connect

mostafa
authored and
rabbitstack
committed
c1d5e61
test(rules): Cover Linux detection compile, matches, and sequences

mostafa
authored and
rabbitstack
committed
630f855
fix(ebpf): Preserve the pid_t sign of signal and trace targets

mostafa
authored and
rabbitstack
committed
27249b2
feat(filter): Extract conservative equality, list, and prefix prefilters

mostafa
authored and
rabbitstack
committed
99d831c
feat(ebpf): Prefilter syscalls with versioned in-kernel maps

mostafa
authored and
rabbitstack
committed
a2b08a7
feat(ebpf): Apply rule and CLI prefilters after maps load

mostafa
authored and
rabbitstack
committed
bdfe340
feat(ebpf): Approve file paths written as trailing-star patterns

mostafa
authored and
rabbitstack
committed
0f0f766
test(ebpf): Cover path lists and separate capture from approval

mostafa
authored and
rabbitstack
committed
5fb51d6
refactor: Confine platform-only helpers to their build tags

mostafa
authored and
rabbitstack
committed
7cbb4b9
feat(build): Add Linux build, lint, and generation-drift targets

mostafa
authored and
rabbitstack
committed
6e374ea
ci: Extend the Linux workflow to lint, race, and a prerequisite probe

mostafa
authored and
rabbitstack
committed
f719cea
docs: Describe the Linux runtime contract and capabilities

mostafa
authored and
rabbitstack
committed
3733934
feat(config): Default the Linux API transport to a UNIX socket

mostafa
authored and
rabbitstack
committed
d3be6a5
feat(build): Package Fibratus for deb and rpm with a systemd unit

mostafa
authored and
rabbitstack
committed
e2113d1
feat(cli): Report eBPF counters in stats and cover both API transports

mostafa
authored and
rabbitstack
committed
7e66a7a
docs: Add Linux install and quick-start instructions

mostafa
authored and
rabbitstack
committed
21baf52
refactor(linux,windows): Reconcile post-rebase state
rabbitstack
committed
639c8b1